SDK overview

Axowl ships four SDK families. Web front-ends use the JS/TS one; on the server pick the client for your runtime — .NET, Node, Python or Java. Every backend SDK does the same three things the same way: verify the end-user token against your org’s JWKS, read permissions with the same wildcard rules, and (optionally) ask Axowl for a server-authoritative answer.

Runtime	Package	Registry	Published today (2026-10-12)	Page
Browser / React	`@axowl/sdk`	npm	✅ 0.3.1 (since 2026-10-07)	Quickstart
Node / Next.js	`@axowl/sdk-backend`	npm	✅ 0.3.2 (since 2026-10-07)	below
.NET	`Axowl.Sdk.Identity.Client` (+ Integrity, Eventing, Korean Identity)	nuget.org	✅ since 2026-09-26 — all nine `Axowl.Sdk.*` packages (Identity.Client 0.2.2)	Identity
Python 3.9+	`axowl-sdk`	PyPI	✅ 0.1.1 (since 2026-09-26)	Python
Java 17+	`com.axowl:axowl-sdk`	Maven Central	✅ 0.1.1 (since 2026-09-26)	Java

JavaScript / TypeScript (`axowl-sdk` repo)

Package	Purpose
`@axowl/sdk` (`packages/react`)	React provider, hooks & components — `AxowlProvider`, `useAxowl`, `usePermission`, `useSession`, `useOrg`, plus drop-in `SignIn`, `SignInButton`, `UserButton`
`@axowl/sdk-backend` (`packages/backend`)	Express middleware (`axowlMiddleware`, `requirePermission`) and Next.js helpers (`getAuth`, `getAuthAsync`, `canAccess`); JWT verification against the org JWKS (`verifyTokenAsync`)
`@axowl/sdk-core` (`packages/core`)	Shared client, token store and permission matching (used internally)
`@axowl/sdk-wasm` (`packages/sdk-wasm`)	WASM integrity-verification core

import { AxowlProvider, useAxowl, usePermission } from '@axowl/sdk';

<AxowlProvider orgSlug="my-org" clientId="client_..."><App /></AxowlProvider>

const { user, isSignedIn, signIn } = useAxowl();
const { can } = usePermission();           // can('dashboard.view')

clientId is the application’s client key (client_..., one per platform × environment, from Applications in the dashboard). The client talks to /api/public/apps/{clientId}/... — login methods, magic link, social, federated, passkey, session handshake.

Features: magic link, social, passkey (FIDO2), and federated (OIDC) sign-in; JWT auto-refresh; wildcard permission matching (sap.fi.*); Express req.axowl context; Next.js App Router & Middleware support; TypeScript-first.

.NET (`Axowl.Sdk.*`, this repo)

Project	Purpose	Page
`Axowl.Sdk.Identity.Client`	Introspection, permission checks, `[RequirePermission]`	Identity
`Axowl.Sdk.Integrity.Client`	Verify sealed records (REST/gRPC/Fallback)	Integrity
`Axowl.Sdk.Eventing.Client`	Publish custom events / poll sealed events	Eventing
`Axowl.Sdk.Korean.Identity.Client`	`[RequireKoreanIdentity]` gating	Korean Identity

Each client uses a 3-layer transport (REST + gRPC over h2c + fallback), confirmed by the Rest*Client / Grpc*Client / Fallback*Client files in each project. A separate Blazor/.NET end-user auth package lives in axowl-sdk/dotnet — see .NET EndUser auth.

Python (`axowl-sdk/python`)

pip install axowl-sdk. verify_token (RS256 against the org JWKS, issuer/audience/expiry), AxowlContext with typed claims and a decoded permission list, axowl.fastapi.AxowlAuth (dependency + require("scope")), and AxowlIdentityClient for introspect / check-permission. See Python SDK.

Java (`axowl-sdk/java`)

com.axowl:axowl-sdk. AxowlTokenVerifier (RS256 against the org JWKS, cached and rate-limited), AxowlContext record, Permissions (wildcard matching + require), AxowlAuthFilter for servlet containers such as Spring Boot, and AxowlIdentityClient for introspect / check-permission. See Java SDK.

Timeouts and caching (added 2026-09-22)

Every client now gives up instead of waiting forever on a stalled connection.

SDK	Setting	Default	Notes
JavaScript (`@axowl/sdk-core`)	`requestTimeoutMs`	15000	Applies to every request the client makes. `0` turns it off.
.NET (`Axowl.Sdk.Identity.Client`, `.Integrity.Client`, `.Eventing.Client`, `.Korean.Identity.Client`)	`CallTimeout`	10 seconds	gRPC deadline and REST timeout for each call.

Other behavior worth knowing:

JavaScript: the list of sign-in methods is cached per client for 5 minutes, and concurrent calls share one request. A change made in the dashboard shows up within that time. A failed fetch is not cached.
.NET: the signing-key set (JWKS) is refreshed every hour, so a rotated key is picked up within the hour. Event polling backs off with jitter when there is nothing new instead of polling on a fixed interval.

The token every backend SDK verifies

An Axowl end-user access token is an RS256 JWT with iss = {api}/api/public/orgs/{orgSlug}, aud = your application key, sub = end-user id, and the claims email, org, org_slug, app, app_group, type ("enduser"), is_employee, cid (the user’s org badge) and permissions (a JSON-encoded string array). Keys are published per organization at {api}/api/public/orgs/{orgSlug}/.well-known/jwks.json. All four backend SDKs verify against exactly that, so a token accepted by one is accepted by the others.

SDK overview

JavaScript / TypeScript (axowl-sdk repo)

.NET (Axowl.Sdk.*, this repo)

Python (axowl-sdk/python)

Java (axowl-sdk/java)